Microsoft Semantic Kernel SessionsPythonPlugin Arbitrary File Write + Startup Persistence (CVE-2026-25592) - ATR-2026-00441 (f3d3546a-1b64-5f77-85db-2c9510cc95a9)
Detects exploitation of CVE-2026-25592 (Critical), arbitrary file write via SessionsPythonPlugin in Microsoft Semantic Kernel. The vulnerable sink accepts unvalidated file paths via DownloadFileAsync; combined with the plugin's ExecuteCode capability, attacker writes payloads to host Startup / cron / systemd-user paths, achieving sandbox escape and persistence. The full kill chain is ExecuteCode -> generate payload -> DownloadFileAsync -> write to autostart directory -> reboot triggers RCE outside the sandbox. This rule detects the over-privileged tool descriptor patterns and the autostart-target file-write payloads that reach the SessionsPythonPlugin sink. CWE-22 (path traversal), CWE-73 (external control of file name). Patches in semantic-kernel Python >= 1.39.4 and .NET >= 1.71.0; this rule detects exploit attempts against unpatched deployments and provides defence-in-depth post-patch by catching the autostart-write pattern regardless of upstream patch state.